Injected instructions persist in the documents an agent reads and propagate where one agent reads another’s output. No filesystem required.
Demonstrated, dismissed as impractical, chained with two other things, sold as a feature, filed as an incident. Every technique here took that route.